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Abstract 

In the past year many developments had taken place in the area of quantum error corrections. 
Recently Shor showed how to perform fault tolerant quantum computation when, rj, the probability for 
a fault in one time step per qubit or per gate, is logarithmically small. This paper improves this bound 
' and shows how to perform fault tolerant quantum computation when the error probability, rj, is smaller 
T-H , than some constant threshold, rjo . The cost is polylogarithmic in time and space, and no measurements 
^ ' are used during the quantum computation. The same result is shown also for quantum circuits which 
Q operate on nearest neighbors only. 

To achieve this noise resistance, we use concatenated quantum error correcting codes. The scheme 
presented is general, and works with any quantum code, conditioned that the code satisfies some re- 
■ strictions, namely that it is a "proper quantum code". The constant threshold rjQ is a function of the 

parameters of the specific proper code used. 
' We present two explicit classes of proper quantum codes. The first example of proper quantum codes 
^ . generalizes classical secret sharing with polynomials. The second uses a known class of quantum codes 
and converts it to a proper code. This class is defined over a field with p elements, which means that 
the elementary quantum particle is not a qubit but a "qupit" . 

We estimate the threshold r]o to be ~ 10~^. Hopefully, this paper motivates a search for proper 
quantum codes with higher thresholds, at which point quantum computation becomes practical. 
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1 Introduction 



^ Quantum computation is believed to be more powerful than classical computation, mainly due to 

the celebrated Shor algorithm ||20|. It is yet unclear whether and how quantum computers will be 
^ physically realizable, [p6| [9|, [7|| b ut as any physical system, they in principle will be subjected to noise, 
such as decoherence [p4 |17[, and inaccuracies. Without error corrections, the effect of noise can 
ruin the entire computation's], ^, so we need to protect the computation against quantum noise. 
Already the question of protecting quantum information is harder than the classical analog because 
^ one should also protect the quantum correlations between the quantum bits (qubits). However, it 
' was shown that good quantum error correcting codes exist, a result which was followed by 

many explicit examples (ex: |l^). This does not immediately imply the existence of noise resistant 
quantum computation, since the computation causes the effect of faults to spread. Recently Shor|ll9| 
showed how to use quantum codes in order to perform fault tolerant quantum computation when the 
noise rate, or the fault probability each time step, per qubit or gate, is polylogarithmically small. In 
this paper, we close the gap and show how to perform fault tolerant quantum computation in the 
presence of constant noise rate, with polylogarithmic cost in time and size. 
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^Institute of Computer science, The Hebrew University, Jerusalem, Israel, E-mail: benor@cs.huji.ac.il 
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The error corrections which where described so far used a combination of classical and quantum 
operations. We would like to define a model of noisy quantum computation such that errors and 
error corrections can be described entirely inside this model. Working in the correct model will enable 
to prove the result of this paper. Sequential quantum computation can not be noise resistant Q, so 
we work with quantum circuits]^, and since the state of a noisy quantum system is in general 
a probability distribution over pure states, i.e. a mixed state, and not merely a pure state as in the 
standard model, we use quantum circuits with mixed states]^. Since noise is a dynamic process which 
depends on time, the circuit will be divided to levels, or time steps. Unlike Yao|2^ we allow qubits to 
be input and output at different times to the circuit. This is crucial, since with the restriction that all 
qubits are initialized at time 0, it is not possible to compute fault tolerantly without an exponential 
blowup in the size of the circuit[^. Between the time steps, we add the noise process, which is a 
probabilistic process: each qubit or gate undergoes a fault with independent probability -q per step, 
and T] is referred to as the noise rate. The list of times and places where faults had occurred, namely 
the fault path, is random, and naturally, the function that the circuit computes is a weighted average 
over the noise process. 

Computing on encoded states: Let us first describe how one can protect quantum information 
against noise, using quantum error correcting codes|^, |2^. The idea behind these codes is, as in 
classical linear block codes, to spread the state of one qubit on a number of qubits, called a "block" , 
such that even if some of the qubits in a block are damaged, the state of the system can be recovered 
from the other correct qubits. If we want to preserve the state of n qubits, we encode it on n blocks. 
The whole state should be recoverable if not too many errors occurred in each block. Quantum codes 
that can correct d faults have the property that if not more than d faults occurred in each block, there 
is some operation that can recover the encoded state given the damaged state. The difference from 
classical codes is that the quantum correlations should be recovered as well, and not only the logical 
states of the qubits. However, it turns out that applying classical error corrections in one basis of the 
Quantum space can correct the logical states, while applying classical error corrections in some other 
basis corresponds to corrections of the quantum correlations. 

In order to protect a quantum computation against faults, one can try to compute on encoded 
states, and not on the states themselves, using quantum codes. The circuit Mi which will compute 
on encoded states is defined as a simulation of the original circuit Mo. A qubit in the original circuit 
transforms to a block of qubits in the simulating circuit, and each time step transforms to a working 
period of several time steps. To simulate the computation done in the t'th time step in Mq, we 
will apply in Mi the analog computation, on encoded states. Each gate in A'Iq will transform to 
some "procedure" in Mi, which computes this gate on encoded states. The procedure might require 
ancilla qubits, so these are added to the circuit A/i, and are initialized only when needed. If Mi is 
initialized with some encoded state, we expect this state to evolve by the computation along some 
"trajectory" , such that at the end of each working period it encodes the correct corresponding state 
of Mq. The input and output to Mi will simply be a duplication of the inputs and outputs of A/q, on 
the corresponding blocks. We will therefore need to add on each block, before computation begins, 
an initialization procedure, that transforms the duplicated input, i.e a string of O's or a string of I's, 
to the encoding state 15*0 >, or |5i >. At the end of the computation we will need the opposite 
transformation, so we will use a reading Procedure that transforms a block in the state |5o > or \Si > 
back to a string of O's or I's. 

Computing on encoded quantum states does not automatically provide protection against faults, 
since errors accumulate, and when the damage has effected too many qubits in one block, the correct 
state is no longer recoverable. In order to be able to correct the state, error corrections should be 
applied all the time, so that the error can not accumulate. Therefore in each working period in Mi we 
will add a step of error corrections of each block. The working period will be divided to two stages: 
a computation stage and a correction stage. The idea is therefore to apply alternately computation 
stages and correction stages, hoping that during the computation stage the damage that accumulated 
is still small enough so that the corrections are still able to correct it. One should notice that this 
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"hope" not always comes true. During the computation faults can "spread" to places not in the fault 
path. This spread can happen if a gate operates on a damaged qubit and some "correct" qubits- in 
general, this can cause all the qubits that participate in the gate to be damaged. If for example, a gate 
procedure consists of one gate operating on the whole block, than one fault is already unrecoverable. 
The procedures should be designed in such a way that a fault can not effect all the qubits in the block. 
In general, a fault at time t in qubit q can effect qubit q' at time t' > t ii there is a path in the circuit 
connecting the points {q,t) and {q',t'). Since we want to be able to correct after each computation 
stage, We can define the "spread" of a procedure as the maximal number of qubits in each block in 
the output of the procedure, which are effected by a fault that happened in this procedure. If we 
use only procedures with small spread, then if not too many errors happened during the computation 
stage in each procedure, the error corrections will still be able to correct the damage using the other 
undamaged qubits. We are actually looking for a pair of a quantum code which can correct d errors, 
and a corresponding set of universal gates, such that their procedures, with respect to the code, 
allow one fault to spread to at most d qubits. Since the error corrections, initialization, and reading 
procedures are also subjected to faults, we need them to have small spread too. Such codes, with the 
corresponding universal set of gates, will be called quantum computation codes. 

We now want to show that the reliability of the simulating circuit is larger than the original 
circuit. In the original circuit, if one fault occurred the computation failed, but the simulating circuit 
can tolerate a number of errors, say fc, in each procedure, since the error corrections correct them 
afterwards. The effective noise rate of Mi is thus the probability for more than k errors in a procedure, 
and it will be smaller than the actual noise rate 77, if the parameters are chosen correctly. However, it 
seems that an improvement from a constant noise rate to polynomially small effective noise rate, as 
we need for fault tolerance, is hard to get in the above scheme. In it is shown how to apply the 
above scheme, with a specific quantum computation code, to achieve fault tolerance when the noise 
rate rj is taken to be logarithmically small. 

Improvement to constant noise rate To improve this result, we use concatenated simulations, 
which generalizes the works of Gacs |]l0|| to the quantum case. The idea is that since the simulating 
circuit is also a circuit, it's effective noise rate can be improved by simulating it again, and so on 
for several levels. Even a very small improvement in each level will suffice since the improvement is 
exponential in the number of levels. Such a small improvement can be achieved when using a code of 
constant block size, if the noise rate is smaller than some threshold 770- Note, that each level simulates 
the error corrections in the simulated level, and adds error corrections in the current level. The final 
circuit thus includes error corrections of all the levels, where the computation of error corrections 
of high levels is corrected all the time in small levels. The lower the level, the more often are error 
corrections of this level applied. This is in correspondence with the fact that lower levels work on 
smaller blocks, that are more likely to be quickly damaged. The whole scheme relies heavily on the 
fact that the places where errors occur are random and independent. Most of the faults will probably 
be corrected by error corrections in the first level, and if this does not work, than using other blocks 
which where corrected in the first level, the error will probably be corrected in the second level. The 
probability that the highest blocks can not be recoverable is polynomially small. 

Not any quantum computation code can be used in the above scheme. There are two restrictions: (1) 
When applying the simulation, we replace the gates by fault tolerant procedures. Since we want to 
simulate the new circuit as well, we need that these procedures use gates that can be replaced by fault 
tolerant procedures as well. Hence the universal set of gates associated with the quantum computation 
code that we use, must have fault tolerant procedures which use gates from the same universal set of 
gates. This is the "closeness" restriction. (2) Let us consider a two level simulation. If a simulated 
error correction operates on an encoded wrong word, it clearly corrects it. But what happens if it gets 
as an input some state which does not encode any word? The simulated error correction "understands" 
only encoded words. If we demand that error correction in the lower level corrects any state to some 
word in the code, than the input for the error correction of the upper level will maybe be wrong but 
it will be an encoded word, so it can be understood and corrected by the upper level. The second 



3 



restriction is therefore that the error correction takes any state to some word in the code. Quantum 
computation codes which satisfy both restrictions are caUed proper quantum computation codes. 

Explicit proper codes over Fp We describe two classes of proper quantum computation codes. We 
first describe the class of quantum codes in 0| generalized to codes over Fp, for any prime p. These 
codes are defined for general quantum circuits which consist of particles with p > 2 possible states to 
be in. We call such quantum particles qupits, as a generalization to qubits. Non binary codes where 
defined independently also by Chuang|l^ and Knill||l^. The proofs that these are quantum codes Q 
transform smoothly from F2 to Fp. For p — 2, we show how to convert these codes to proper quantum 
codes, using the set of gates and procedures described in which are modified to fit the definition 
of proper quantum codes. The second example of proper quantum codes uses a special case of the 
linear quantum codes, which is the quantum analog of random polynomial codes The requirements 
imposed on quantum computation codes are actually very similar to the requirements that are imposed 
on the secret sharing schemes that are used to perform secure fault-tolerant distributed computation 
Q. In both cases measuring a few qubits, or reading a few secret shares, must give no information 
about the unencoded data, and in both cases we must show how to perform computation in a fault- 
tolerant way on the encoded data. To adopt the techniques of Q to the quantum setting one can use 
the same encoding but instead of selecting a random polynomial to share a secret we simply pick the 
superposition of all those polynomials. 

The noise rate threshold is shown to be larger than ~ 10^^. 

The results of this paper hold also with a more general noise model, in which for all integer k, 
for any set of k points, the probability that a fault occured in all the points is bounded by 77*^, and 
an adversary can pick a transformation that operates on all the damaged qubits together. The same 
result is true for quantum circuits which are allowed to operate only on nearest neighbor qubits (In 
this case the threshold will be smaller.) 

Similar results to those of this paper where independently discovered by Knill, Lafiamme and 
Zurek|l|. 

Organization of paper: In section 2 we define the model of noisy quantum circuits. Section 3 
is devoted to describe one step of the simulation, given any quantum computation code. In section 4 
we present concatenated simulations and prove that this scheme provides noise resistant computation 
in the presence of a constant noise rate, given any proper quantum code. In section 5 we present 
two explicit classes of proper quantum computation code. Section 6 discusses possible extensions, 
conclusions and open questions. 

2 Noisy Quantum Circuits 

In this section we recall the definitions of quantum circuits ^, ^ with mixed states]^. We then 
define noisy quantum circuits, which model a physical realization of quantum circuits The faults 
are probabilistic, and occur in single qubits and in gates. 

2.0.1 Pure states 

We deal with systems of n two-state quantum particles, or "qubits" . The pure state of such a system 
is a unit vector, denoted \a), in the 2" dimensional complex space . We view as a tensor 
product of n two dimensional spaces, each corresponding to a qubit: = (8) ... ® C^. As a basis 
for , we use the 2" orthogonal basic states: \i) = \ii) ^ |i2)---- ^ |«n),0 < i < 2", where i is in 
binary representation, and each ij gets or 1. A general unit vector \a) in is called a "pure state", 

and is a superposition of the basic states: |a) = X]i=i with X]i=i I'^jP = 1- 1*^) corresponds to 
the vector Va = (ci,C2, ...,C2"). w^, the complex conjugate of Va, is denoted (a|. The inner product 
between |a) and \f3) is (a|/3) = (va,vj^). The matrix v|,V/3 is denoted as An isolated system of 

n qubits develops in time by a unitary matrix, of size 2" x 2": \a{t2)) — lJ\oL(t\)). A quantum system 
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in can be observed by measuring the system. An important measurement is a basic measurement 
of a qubit q, of which the possible outcomes are 0, 1. For the state \a) = J2i=i Ci\i), the probability 
for outcome is po = J2i i|,=o l^iP ^^'^ state of the system will collapse to |/?) = ^ J2i i|,=o ^iK)) 
(the same for 1). A unitary operation U on k qubits can be applied on n qubits, n > fc, by taking 
the extension U of U, i.e. the tensor product of U with an identity matrix on the other qubits. 
The defBnition can be generalised to circuits which operate on p— state quantum particles, or qupits. 
(simply replace 2 by p in the definitions above). 

2.0.2 Mixed states 

A system which is not ideally isolated from it's environment is described by a mixed state. There are 
two equivalent descriptions of mixed states: mixtures and density matrices. We use density matrices 
in this paper. A system in the mixture {a} = {pk, \ak)} is with probability Pk in the pure state 
|afe). The rules of development in time and measurements for mixtures are obtained by applying 
classical probability to the rules for pure states. A density matrix p on is an hermitian positive 
semi definite complex matrix of dimensions 2" x 2", with tr{p) = 1. A pure state |a) = ^iCi\i) 
is associated the density matrix p^^) = \ct}{ct\ i-e- P\a){i,j) = CiC*. A mixture {a} = {pi,\ai)}, is 
associated the density matrix : = ^^iPlPlai)- The operations on a density matrix are defined 

such that the correspondence to mixtures is preserved. If a unitary matrix U transforms the mixture 
{a} = {pi,\ai)} to {(3} = {pi,U\ai)}, then p^fj^ = J2iPiU\ai){ai\U^ = C/p{a};7^ A basic measurement 
of the j'th qubit in p gives, the outcome with the probability which is the sum of the diagonal terms 
of p, which relate to the basic states i with ij = 0: pr{0) = '}2i=i PiS^i^j = 0). conditioned that the 
outcome is the eigenvalue 0, the resulting density matrix is Oq o (p), which is the minor of p which 
includes only rows and columns which relate to basic states i with ij = 0. (This minor should of 
course be normalized to have trace one). Without conditioning on the outcome the resulting density 
matrix will be O o (p) = Pr(0)Oo o (p) + Pr(l)Oi o (p). which differs from p, only in that the entries 
in p which connected between and 1 on the same qubit are put to zero. Given a density matrix p of 
n qTibits, the reduced density matrix of a subsystem, A, of, say, m qubits is defined as an average over 

the states of the other qubits: p\A{i,j) = J^k^i p{ik,jk)- 

2.1 Quantum circuits with mixed states 

A quantum unitary gate, g, of order A; is a complex unitary matrix of size 2^ . A density matrix 
p will transform by the gate to g o p = UpW, where IJ is the extension of U. A Quantum circuit is a 
directed acyclic graph with n inputs and n outputs. Each node v in the graph is labeled by a quantum 
gate gy. The in-degree and out-degree of v are equal to the order of gy. Some of the outputs are 
labeled "result" to indic;ate that these are the qubits that will give the output of the circuit. The wires 
in the circuit correspond to qubits. An initial density matrix p transforms by a circuit Q to a final 
density matrix Q o p = gto ...o g2 gio p, where the gates gt---gi are applied in a topological order. For 
an input string i, the initial density matrix is p^^y The output of the circuit is the outcome of applying 
basic measurements of the result qubits, on the final density matrix Q o p^^y Since the outcomes of 
measurements are random, the function that the circuit computes is a probabilistic function, i.e. for 
input i it outputs strings according to a distribution which depends on i. 

2.2 Noisy Quantum Circuits 

As any physical system, a quantum system is subjected to noise. The process of noise is dynamic 
and depends on time. We therefore divide the quantum circuit to levels, or time steps. We permit 
that qubits are input and output at different times, and we say a qubit is alive from ti to t2 if it is 
input to the circuit at ti and output at ^2- The "space time" of the noisy quantum circuit is a two 
dimentional array, consisting of all the pairs {q,t), of a qubit q and time t, where the qubit q is alive 
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at time t. The volume of the circuit M, is the number of points in it's space time and it is denoted 
by V{M). 

In our model of noisy quantum circuits each qubit and each gate are damaged with probability 
1/2 > ry > each time step. The damage operates as follows: A unitary operation operates on the 
qubit, (or on the qubits that are output from the gate in the case of a gate damage) and on a state 
of the environment (The environment can be represented by m qubits in some state). This operation 
results in a density matrix of the n + m qubits. We reduce this density matrix to the n qubits of the 
circuit to get the new density matrix after the damage. A noise step happens between two levels, or 
two time steps of computation, and in a noise step each gate or qubit is damaged with probability 
rj. The density matrix of the circuit develops by applying alternately computation steps and noise 
steps. Each "run" of the computation is subjected to a specific "fault path" , which indicates where 
and when fault occured. Each run ends up with some output. The function computed by the noisy 
quantum circuit is naturally the average over the outputs, on the probabilistic process of noise. 

3 Quantum computation on encoded states 

In the following section we define quantum codes and quantum computation codes. Then we 
describe how to improve reliability of computation using quantum computation codes. Quantum 
computation codes are used abstractly in this section, while explicit examples of such codes are given 
in section ^. 

3.1 Quantum block codes 

A quantum linear block linear code is a function from the Hilbert space of a qubit to a Hilbert 
space of m qubits: : i — > . to is called the size of the block in the code. Such a code induces 
a linear function from to in the following way: a pure state in , \a) = X^i^ili) will 

transform to \f3) = Ci(j)\ii)(j)\i2) ■■■(t>\in) ■ A pure state in the image of is called a word in the code. 
The above definition can be extended to density matrices: A mixed state of n qubits will be encoded 
by the corresponding probability over the encoding of the pure states. A mixture of words in the code 
is also said to be in the code. 

The error in the encoded state is sparse if not too many qubits in each block are damaged. Using 
this notion of sparse sets, we can define a metric on block density matrices. They will be close if the 
deviation between them is confined to a sparse set of qubits: 

Definition 1 Let B be the qubits in n blocks of m qubits. A set A Cz B of qubits is said to be k— sparse 
if in each block there are not more than k qubits in A. Two density matrices pi and p2 of the qubits 
B are said to be k— deviated if there is an k— sparse set of qubits, A, such that reduced on all qubits 
except those in A they are equal: Pi\b-a — P2\b-a- 

The deviation is a metric since it satisfies the triangal inequality, and it is zero only for equal density 
matrices. The quantum code corrects d errors if there is some recovery procedure R, that when applied 
on all the blocks in any density matrix that d-deviates from a code word w, the output is the recovered 
word w (maybe tensored product with ancilla qubits used by the correction procedure). 

3.2 Quantum computation codes 

A computation code is a quantum code which provides a way to perform gates on the encoded 
states fault tolerantly. The procedure Pg that simulates a gate g with respect to a quantum code is a 
sequence of gates which transforms the encoded state to the encoded output of the gate: P(;(0(i)(g)|O > 
) = 4'{9{i)) ® |a >j where we have used extra ancilla qubits. These qubits are not counted as the 
inputs or outputs of the procedure. A quantum procedure is said to have spread / if no qubit or gate 
effects more than I outputs of the procedure. We will need procedures with small spread for fault 
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tolerant computation. Since we want to convert any arbitrary circuit to a more reliable one, we need 

the set of gates that have ^-spread procedures to be universal. 

Definition 2 A quantum block code C is said to be a quantum computation code with spread I if there 
exists a universal set of quantum gates G such that (1) for any gate g & G there exists a procedure Pg 
with respect to C, with spread I, and (2) There exist correction , initialization and reading procedures 
with spread I. 

3.3 Improving reliability by block simulations 

To simulate some circuit by a quantum computation code, we first convert it to a circuit which uses 
only gates from the universal set of the code. Then we simulate this new circuit as was explained: We 
now convert each qubit to a block of qubits, each time step to a working period, and each gate to the 
corresponding procedure, and besides that we add in each working period a correction procedure on 
each block. Apart from all that, we also add initialization procedures before the first working period 
of each computation block and a reading procedure after the last working period of each result block. 

The space-time of the simulating circuit Mi can be devided to rectangles, where each rectangle 
will correspond to one procedure, in the following way: First, devide the time to alternating stages: 
computation stages, in which one time step of Mq is simulated, i.e. one level of gate procedures is 
applied, and a corrections stage, in which one level of error correction procedures are applied. Each 
stage is a "strip" in the space time. Each strip can be devided to rectangles by deviding the qubits 
to sets: A correction strip will be devided such that in each rectangle a correction of one qubit is 
computed. In a computation strip, we devide the strip to rectangles by deviding the qubits to sets, 
where each set of qubits participates in exactly one procedure. Each rectangle thus corresponds to 
one procedure. 

We show that if a fault path in Mi is such that no more than a few faults occured in each rectangle, 
then indeed the computation succeeds. The number of faults allowed in one rectangle is bounded so 
that when taking into account the spread of the fault, the number of qubits effected in each block at 
the end of one working period is not too big, so that the density matrix can still be recovered. 

Definition 3 A fault path of a medium Mi that block simulates Mq is said to be a "k— sparse fault 
path" if no more than k faults occured in each rectangle. 



Lemma 1 Let C be a quantum computation code that corrects d errors, with spread I. Let Mi be 
a block simulating circuit. Consider a computation of Mi subjected to a k— sparse fault path with 
d > 2kl. At the end of each working period the density matrix is d— deviated from the correct one. 

Proof: We will prove by induction on i a stronger assertion, that at the end of the t'th working period 
the density matrix is d/2— deviated from the correct one. For t = Q the deviation is zero. Suppose 
that the density matrix at the end of the i'th working period is (i/2-deviated from the correct matrix. 
After the computation stage, not more than kl qubits are effected in each block, so the density matrix 
is kl + rf/2-deviated. Since kl + d/2 < d, the correction procedure indeed corrects the error, only that 
during the corrections new errors occur. Again, the number of effected qubits is not more than kl in 
each block, and all the other qubits transform as they should, so they are corrected. Hence after the 
correction procedure the matrix is fcZ-deviated. Since kl < d/2 this proves the induction step.l 

We can now compute the effective noise rate of Mi. This will be smaller than r] if the parameters 
are chosen correctly: 

Theorem 1 Let Mi simulate Mq by the computation code C, which corrects d errors, have spread I, 
with all rectangles smaller than a. The effective noise rate of Mi is <2 ( , ) r]^~^^. 
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Proof: If the fault path in Mi is d/2l sparse, the final density matrix is d— deviated from the 
correct one by lemma |^. Measuring all the qubits in the result blocks, and taking majority in each 
block, gives the correct answer by lemma |3| in the appendixes. The number of the rectangles in Mi is 
less than twice the number of points where faults can occur in Mq. Therefore the effective noise rate 
is smaller than the probability for not more than d/2l faults in two rectangles of Mi. The probability 
for a rectangle to have more than k faults is smaller then the number of possibilities to choose fc + 1 
points in the rectangle, times the probability for these points to have a fault, which gives the result. | 

4 Concatenated simulations 

In this section, we define proper quantum code, and concatenated simulations by such codes. We 
prove that the reliability of the computation can be improved to a constant using log(log{n)) levels 
of simulations, when the noise is smaller then some constant imposed by the parameters of the code. 

4.1 Improving reliability to a constant 

We define a proper quantum code: 

Definition 4 A quantum computation code which is associated a set of gates G is proper if (1) The 
gate procedures, and the initialization, reading and correction procedures use only gates from G, and 
(2) The correction procedure takes any density matrix to some word in the code. 

Let Mq be a quantum circuit. We define recursively M^, an r-simulating circuit of a circuit Mq by 
the proper quantum computation code C, as the simulation by G of M^-i- The recursive simulations 
induce a definition of s-blocks: Every qubit in one stage of the simulation transforms to a block of m 
qubits in the next stage of the simulation, and this block transforms to m blocks and so on. One qubit 
in Mr-s transforms to m'^ qubits in Mr. This set of qubits in Mr is called an s-block. An 0-block in 
Mr is simply a qubit. The recursive simulations also induce a definition of s-rectangles: Each space 
time point in Mr-s transforms to a set of space time points in the following simulation Af(r-s+i): 
which in their turn transform to more points in the following stages of the simulation. The set of all 
these points in Mr that originated from one space time point in M(^r-s) ^-re called an s-rectangle. The 
definition of s-rectangles defines a devision of the space time of M^, and this devision is a refinement 
of the devision to (s + l)-rectangles. An 0-rectangle is just a space time point in Mr. 

A density matrix of Mr is recovarable if it deviates on a "sparse" set of qubits, i.e that in each 
level, there are enough blocks that can be recovered. If at some level there are enough blocks that 
can be recovered, the other blocks will be corrected by the error corrections in the upper level. 

Definition 5 Let B be the set of qubits in n r— blocks . An (r, k) -.sparse set of qubits A in B is a set 
of qubits in which for every r~block in B, there are at most k {r — l)^blocks such that the set A in 
these blocks is not (r — 1, fc) sparse. An (0, k)— sparse set of qubits A is an empty set of qubits. Two 
density matrices pi, P2, are said to be (r, k)-deviated if there exist an (r, k)-sparse set of qubits A G B, 
such that Pi\b-a = P2\b~a- 

The deviation is a metric, as is shown in the appendixes, lemma |[ We define "sparse" fault paths, 
that do not increase the deviation in this metric too much: 

Definition 6 A set of space time points in an r— rectangle is said to be {r,k) -.sparse if there are no 
more than k {r — 1)— rectangles, in which the set is not {r — l,k)-sparse. An (0, k)-sparse set in an 
0— rectangles (which is one space time point) is an empty set. a fault path in Mr is (r, k) -sparse if in 
each r —rectangle, the set is (r, k) — .sparse. 

We claim that if the fault path is sparse enough, then the error corrections keep the deviation small. 
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Lemma 2 Let C he a proper code that corrects d errors, with spread I. Let Mr be a medium which 
r— simulates Mq by C. Consider a computation subjected to an (r, k)-sparse fault path with 2kl < d. 
At the end of each r~working period the density matrix is (r, d/ 2) -deviated from the correct one. 

Proof:The proof is by induction on r. The structure of the proof goes as foUows: we first prove 
by induction on the number of levels, r, three assertions together. Assuming that the fault path is 
(r, /c)-sparse, an r-computation stage does not cause too much r— deviation, an r— correction corrects 
a small enough r— deviation, and an r— correction brings any state to a density metric which is not 
too r— deviated from some word in the code. The first two assertions applied alternately for the 
r— computation and r— correction stage in Mr, will give the desired result. The proof involves many 
details, and is given in the appendixes. | 

We can now prove the main result of this paper: 

Theorem 2 Let C be a quantum computation code, which corrects d errors, have spread I, and size 
of all procedures smaller than a. Let Mq be a quantum circuit, with size s and depth t. There exists a 
quantum circuit Mr of size 0{s ■ poly log (s)) and depth 0{t ■ polylog{t)), such that in the presence of 

noise rj which satisfies ^ ^^2/^+ 1 ) '7''^^' < 1 -^^r outputs the correct answer with probability > 2/3. 

Proof: If the fault path is (r, (i/2/)-sparse, than the final density matrix is indeed (r, (i)-deviated from 
the correct one, by lemma |[ Measuring all result blocks in a density matrix (r, (i)-deviated from the 
correct final density matrix, and taking majority in each r-block, gives the correct answer by lemma 
^ in the appendixes. Hence the probability for Mr to succeed is larger than the probability for a fault 
path to be (r, (i/2Z)-sparse. With the assumption on -q, the probability for one rectangle to have a set 
of faults which is (r, ci/2/)-sparse can be shown to be exponentially (in r) close to one. Again, details 
can be found in the appendix. Taking r to be 0{log{log{V (Mq))) makes this probability high enough. 
Since the growth in cost is exponential in r, (we use codes with a constant size), and the number of 
levels is 0{log{log{V{Mo))), the cost is poly logarithmic. | 

Remark: Theorem ^ requires that the code can correct d > 1 errors. A similar result holds for 
d — 1, with the threshold ( ^ ] rj < 1 where b is the maximal size of slightly different rectangles. 



^ 2 ^ 

defined to contain a computation and a correction procedure together. The proof is almost the same 
In some cases this threshold is better. | 



5 Explicit proper quantum computation codes 

Linear quantum codesQ are represented, using classical codes over Fp, and shown to be proper for 
p = 2. A subclass of linear codes, polynomial quantum codes, is defined and shown to be proper. 



5.1 Linear quantum codes over 



A linear code of length m and dimension k over the field Fp is a subspace of dimension k in F^, 
where is the m dimensional vector space over the field of p elements. Given two linear codes Ci 
and C2 such that {0} C C2 C Ci C i^™ consider the following set of quantum states in the Hilbert 
space C^'" : 

Va e CI : \Sa >= ^ \a + v> . 

If (al — a2) G C2 than \Sai >= 15*02 >, otherwise < Sai\Sa2 >= 0. Hence these states construct 
a basis for a linear subspace of the Hilbert space , with dimention z = p<^™(C'i)-djm(C2) xhis 
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subspace is our quantum code. Define a second basis of this subspace to be: 
Wa e : \Ca >^ ^ w''-''\Sb > , w = . 

If CI and C2 both have minimum weight c?, then the quantum code can correct for t = L'^T^'J j tiy 
applying classical error corrections with respect to the code Ci, first in the S*— basis, and than in the 
C— basis. The proofs in Q transforms smoothly to this general case. 

Theorem 3 For p — 2, linear codes are proper and have spread I — 1. 

Proof: The universal set of gates which is associated with the above codes is: 
|a, b >i — > \a,a + b >, 

\a >i — y |1 — a >, 

\a >i — > >, and 

|a, 6, c >i — > |a, b,c + ab >, 

where all the addition and multiplication are in F2(i.e. mod 2). This set is universal [p^. The 
correction procedure is done by applying classical error corrections, with respect to the code Ci, 
transforming to the C— basis by applying bitwise the gate \a >i — > X]fc(~l)"''l^ > correcting 
classically again and rotating back to the S'— basis. The initialization is an error correction, with 
respect to the code C2 and not Ci, which corresponds to the quantum error correction to the code 
which consists of j^o > alone. The reading procedure is applied by computing independently m times 
the a from the state \Sa >■ To apply the procedures of all the gates, except the Toffoli gate, we simply 
apply the gate bitwise on all the qubits (if the block size is m, we apply the gate m times). A detailed 
description is given in the appendixes. The spread of all these procedures is I = l.| 



5.2 Polynomial quantum codes 



To correct d errors, set m — Ad + I and set p > m + I. Let ai, 02, am be m distinct non zero 
elements of Fp such that the polynomial G{x) = Il™^^{x — Oi) has a non-zero coefficient of x'^'^. (Such 
ai exist because |Fp| > m + 1). Denote by 

Vi = {fix) e F{x) I degfix) < d} , 

V2 = {feVi\ /(O) = 0} , 

Ci = {(/(ai), /(a™)) I / e 1/1} C F^, 
C2 = {(/(ai),...,/(a„)) \f€V2}(lC,. 

As before, we use the codes Ci and C2 to define the quantum code: 

VaeF, \S,>^^— J2 |/(ai),...,/(a,„)>. 



Theorem 4 Polynomial codes are proper quantum computation codes with spread 1 = 1. 

Proof: The universal set of gates used is: 
V c e F, |a >i — > \a + 0, 
\a > \b >i — > \a> \a + b>, 
^ ce F: \a >i — > \ac >, 
\a> \b> \c >i — > \a> \b> \c + ab >, 
Vce F \a >i — > w'"^\a >, and 

for < r < p, the Fourier transform: \a >i — > J2beF ^^''^"''1^ > ■ 

Clearly, all classical reversible functions can be spanned by this set. We find an explicit unitary 
matrix in the group generated by this set, which has infinite order. We than use group representation 
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theory to show that this group is dense in SU{n). By |Q, the rate of approaching each finite 
matrix is exponentially fast. The initialization, reading and correction procedure are exactly as in 
the general linear code, where transforming between the 5*— basis and the C— basis is done by the 
Fourier transform. The procedures \Sa >i — > \S{a + c) >, \Sa > \Sb >i — > \Sa > \S{a + b) >, and 
\Sa >i — > \S{ac) > can be performed by applying pitwise the corresponding gates. Other procedures 
use interpolation techniques | 

6 Generalizations and open problems 

The result implies that quantum computation might be practical if the noise in the system can be 
made very small. The results should motivate physicists to achieve lower noise rates, and theoreticians 
to develop a theory for proper quantum codes, and seek such codes with better parameters, to push 
the threshold as high as possible. The point at which the physical data meets the theoretical threshold 
is where quantum computation becomes practical. 

The results of this paper hold also in the case of circuits which allow to operate only on nearest 
neighbors. (We thank Richard Cleve for pointing that out to us.) This is true since the procedures we 
use, which are of constant size, can be made, with constant cost, to operate only on nearest neighbors, 
by adding gates that swap between qubits. However, the bound on 77 in this case will be smaller. 

We are grateful to I. Cirac and P. ZoUcr for the following idea: In most quantum systems, it is 
reasonable to assume that different types of faults occur with different frequencies. In such systems, 
one can improve the bound on the noise rate significantly, by using in most levels of the simulation a 
quantum code which can correct only for the most frequent errors, while for less frequent errors it is 
enough to correct only once in a few levels. Examples will be given in the final version. It is therefore 
important to have good understanding of the different noise rates for different types of faults, for 
specific potential physical realizations of quantum computers. 

Our scheme requires a poly logarithmic blow-up in the depth of the circuit. Multilinear Quantum 
codes can reduce the depth from a multiplicative factor of 0{log{n) to a factor of 0{log{log{n)), but 
reducing this to a constant, as in the classical case, remains an open problem. 
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8 Appendix A 

Here wc give the proof that the if the final density matrix is rf— deviated from the correct one, than 
measuring the qubits and taking majority gives the correct answer. 

Lemma 3 ; Let pO be the density matrix of the mixed state {a} = {pk, \ak >}, where \ak >= 
Si cf'li >. Let pi be a density matrix of the mixed state = {pk, |/3fe >} where is generated from. 
\ak > by duplicating each qubit m times: |/3fe >= cf j?,™?'™.--'-™ >• -^^^ '^1 ^ density matrix which 
is d— deviated from pi, where 2d < m. Then measuring the qubits in al, and taking the majority in 
each block generates a distribution on n— strings which is equal to that generated when measuring pO. 

Proof: This lemma proves that when the fault path is fc— sparse, at the end of the computation 

the density matrix reduced to the result blocks, is rf-deviatcd from the correct one reduced to the 
result blocks. Note that due to the reading procedures, the correct density matrix is a mixed state in 
the subspace of , which is spanned by basic states in which all the coordinates in one block are 
equal, i.e >• 

We will claim that the distribution D on n — strings generated by measuring all qubits in pi and 
taking the majority is the same as the distribution D' , generated when measuring al and taking the 
majority. The probability to get an n-string i when measuring pO, is J^kP^Wil^- "^^^ probability to 
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get an n-string i when measuring pi, and taking the majority is the same. When measuring the qubits 
in A, in trl, one gets the same answer on all the qubits in one block, since al reduced to A equals 
pi. Hence, these qubits determine the majority vote, so the probability to get an n-string i when 
measuring al, and taking the majority is the same as the probability to get this n-string i duplicated 
on A when measuring A in al, which is the same as the probability to get this n-string i duplicated 
on A when measuring A in pi, which is the correct probability.! 

9 Appendix B 

We prove that the deviation is a metric: 

Lemma 4 ; Let C be the set of qubits in n r— blocks. Let A, B Cz C be two sets of qubits which are 
(r, Zi), (r, ^2) sparse respectively. Then, AClB is {r,li + I2) sparse. 

Proof: To see this, use induction on r. For r — 0, the union of two empty sets is empty. Let us 
assume for r, and prove for r + 1. A is {r + l,li) sparse, so there are at most h r— blocks which are 
not (r, h) sparse. S is (r -I- 1, ^2) sparse, so there are at most I2 r— blocks which are not (r, I2) sparse. 
In all the other r— blocks, the union oi A and B is (r, li + I2) sparse by induction. So there are at most 
^1 + h r— blocks in which the union is not (r, li + I2) sparse, so the union is (r + 1, /i -I- 12) sparse.l 



10 Appendix C 

In this appendix we give the proof of the main theorem, that concatanated simulation provide noise 
resistance. We first prove a lemma and than give the theorem: 

Lemma |^: Let C be a proper code that corrects d errors, with spread I. Let be a medium 
which r— simulates MO by C . Consider a computation subjected to an (r, fc)-sparse fault path with 
2kl < d. At the end of each r— working period the density matrix is (r, d/2) deviated from the correct 
one. 

Proof:We first prove by induction on the number of levels r three assertions, together. 

1. Consider n r— blocks, in a density matrix which is (r, fc^)— deviated from (j/{pQ), where po is 
a density matrix of n qubits. After applying one stage of r — computations on these blocks, 
simulating the operation g on with an (r, k) sparse set of faults, the density matrix is (r, d) 
deviated from <jf{g ° po). 

2. Consider n r— blocks, in a density matrix pr, which is (r, d) deviated from a word (jf [po), where 
po is a density matrix of n qubits. After applying r— corrections, on all of the r— blocks, with 
an (r, k) sparse set of faults, the density matrix is (r, kl) deviated from (j/ [p^)). 

3. Consider n r— blocks, in some density matrix, p^. After applying r— corrections, on all of the 
r— blocks, with an (r, k) sparse set of faults, the density matrix is (r, kl) deviated from a word 
(j)^{p()), where po is a density matrix of n qubits. 

For r = the proof is trivial. The computations are just faultless, and 0— corrections are the 
identity. For instructiveness, let us consider also the case of r = 1. Claims |,| are satisfied merely 
because we use a computation code. Claim ^ is satisfied by the extra restriction on the error correction 
which a proper code satisfies. Let us now assume all the claims for r, and prove each of the claims for 
r + 1, starting with claim number |l|. 

1. We consider one stage of (r -I- 1)— computations on these blocks, (r + 1)— simulating the operation 
g on pq. The stage of computation (r + 1)— rectangles can be viewed as a sequence of alternating stages 
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of computation (r)— rectangles and correction (r)— rectangles. ( The number of stages of r— rectangles 
during this (r + 1)— rectangle is w.) Let us consider the density matrices in the trajectory of <p'^~^^{po), 
at the end of each of these r— stages. These matrices can be written as (p'^{p\). Where pi — 4>{po) 
and = 4'{g ° Po)- Let us assume for a second that all the (r)— rectangles in the (r + 1)— stage have 
(r, k) sparse set of faults. (This assumption is wrong- in each (r + 1)— rectangle we might have k 
(r)— rectangles in which the faults are not (r, k) sparse, but we will deal with this in a second.) Let us 
also assume that the density matrix we start with is (r, fc^)-deviated from (f>'^^^{pQ), meaning that we 
do not allow kl r— blocks in each (r-|- 1)— block to be more than /cZ— deviated. With these assumptions, 
we now prove by induction on t that applying an r— correction stage followed by an r— computation 
stage, on a matrix which is (r, A;Z)-deviated from (j)^(p\), gives a matrix which is (r, A;Z)-deviated from 
This is true by applying the induction assumption of claims |l|, and |^. Now, there might 
still be k r— rectangles with more faults than we assumed, in each (r + 1)— rectangle, and in the 
initial density matrix there might still be kl r— blocks with more deviations than we assumed, in each 
(r + l)— block. Since the (r + l)— stage simulates a computation procedure which has a maximal spread 
I, these r— rectangles and r— blocks can effect only l{kl + l) number of r— blocks in each (r + 1)— block, 
at the end of the (r + 1)— stage- so if l{kl + I) < d, we have that the final density matrix at the end 
of th e (r -I- 1)— stage is (r -I- 1, d)— deviated from the correct one. 

2. We consider one stage of (r + 1)— corrections on the n {r + 1)— blocks. This stage can be viewed 
as a sequence of alternating stages of computation (r)— rectangles and correction (r)— rectangles. ( 
The number of stages of r— rectangles during this (r + 1)— rectangle is w.) Let us consider the 
trajectory of where pi is a density matrix which is (1, d)— deviated from some word (j){po), 

and denote the density matrices in this trajectory at the end of each r— stages by (jf{p\). Then since 
the (r -|- 1)— rectangle simulates error correction, and the simulated matrix is not too deviated, the 
trajectory which starts with p^ = pi r— simulated, will end with p^ — (j){pQ), r— simulated. Now, 
let us assume, again, that all the (r)— rectangles in the (r -f 1)— stage have {r,k) sparse set of faults, 
and that the density matrix we start with is (r, d)-deviated from (jf{pi). With these assumptions, we 
can now prove by induction on t that applying an r— correction stage followed by an r— computation 
stage, on a matrix which is (r, A;Z)-deviated from (jf{p\), gives a matrix which is (r, A:Z)-deviated from 
(jf{p\^^). This is true by applying the induction assumption of claims 0, and ^. So under the above 
assumptions, we end up with a matrix which is (r, c?)-deviated from (jf^^{pf)). Now, we actually 
start the computation with a matrix which is (r -I- 1, d)— deviated from 0'''^^(po)- So most of the 
r— blocks are (r, d)— deviated from (ff^'^{pQ), except maybe d r— blocks in each (r -I- 1)— block which 
are not. By the induction stage on claims |^ and ^, after the first stage of r— corrections, most of the 
r— blocks are (r, fcZ)— deviated from 0''+^(po), except maybe d r— blocks in each (r -|- 1)— block which 
are (r, /cZ)— deviated from (jf [p'l). So after the first r— correction the density matrix is (r, fcZ)— deviated 
from (f)^{pi), where pi is (1, d)— deviated from (j){po)- We can now use the induction from before and 
say that the final density matrix is (r, fcZ)-deviated from <j)'^~^^{po). We now take into account the 
fact that there where r— rectangles where the faults where not (r, fc)— sparse. By the fact that the 
(r + 1)— correction simulates an Z— fualt tolerant procedure, these can effect only kl r— blocks in each 
(r + 1)— block, at the end of the (r -I- 1)— stage, so we have that the final density matrix at the end of 
the (r -I- 1)— stage is (r -I- 1, fc/)— deviated from the correct one. 

a. We consider one stage of (r + 1)— corrections on the n {r + 1)— blocks, in some density matrix. 
This stage can be viewed as a sequence of alternating stages of computation (r)— rectangles and 
correction (r)— rectangles. ( The number of stages of r— rectangles during this (r 4- 1)— rectangle is 
w.) Again, let us assume that the faults in all the i — rectangles are {r, fc)— sparse. By the induction 
stage on claim ^, after one stage of r— corrections, the density matrix is (r, /cZ)— deviated from some 
<lf{pi). Let us consider the trajectory of (f>^{pi) in the (r -I- 1)— correction rectangle. Since it is an 
r— simulation of a correction, it takes the density matrix to some word (/'''^^(po)- As before, we can 
prove by induction on the r— stages that at the end of the (r + 1)— rectangle we end up with a matrix 
which is (r, fcZ)— deviated from (j)'^^^{po), and taking into account the r— rectangles with faults which 
are not (r. A:)— sparse, we end up with a density matrix which is (r + 1, fcZ)— deviated from 0''+^(/9o). 
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We can now use claims ^ and Q alternately to prove by induction on the number of r— working 
period that at the end of each r— working period in Mr the density matrix is (r, fc^)— deviated from 
the correct one. | 

We can now prove the main result of this paper: 

Theorem ^ Let C be a quantum computation code, which corrects d errors, have block size m, 
{2d < m), have spread and size of all procedures smaller than a. Let Mq be a quantum circuit, 
with size s and depth d. There exists a quantum circuit Mr of size 0{s ■ polylog{s)) and depth 

0{d ■ polylog{d)), such that in the presence of noise rj which satisfies ^ dj'^ ^ \ ^ -q'^/'^i < i Mr 

outputs the correct answer with probability > 2/3. 

Proof: When measuring all qubits in a density matrix (r, (i)-deviated from the correct final density 
matrix, and taking majority in each r-block gives the correct answer by lemma ^. If the fault path 
is (r, (i/2l)-sparse, than the final density matrix is indeed (r, d)-deviated from the correct one, by 
lemma ^ Hence the probability for Mr to succeed is larger than the probability for a fault path to be 
(r, d/2Z)-sparse. Let us show by induction on r that the probability of the faults in an r— rectangle to 

be {r,d/2l) sparse is higher than 1 — 7y(i+^) , where we set ^ d/2l + 1 ) '7'*^^'^^ = 'y^^*^. We can do 

that because of the assumption on the parameters, e is therefore a positive constant. The probability 
for an 0— rectangle, i.e. one space time point, to have faults which are (0, d/2l) sparse, i.e. that in this 
point a fault did not occur, is 1 — 77. For the step of the induction, assume for r, and let us prove for 
r+ 1. For the faults in an (r + l)-rectangle to be (r + l, k) sparse, there must be at most k r— rectangles 

in which the fault is not (r, fc) sparse. So P{r + 1) > 1 — ^ d/2l + 1 ) ^"'^ ^ pj,'^d/2i+i ^ which gives 

the desired result using the induction assumption and the definition of 77^+*^. This proves that the 
probability of success of Mr, satisfies Pr > (1 — since the number of r— rectangles is 

less than 2V{M0). Taking r to be 0{log{log{V{MQ))) gives Pr which is a constant. Since the growth 
in cost is exponential in r, (we use codes with a constant size) the blowup that is accumulated in 
O {log {log {V {Mo))) is polylogarithmic. | 
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This appendix gives a full description of the fault tolerant procedures for linear codes. 
(1) Initialization procedure: 

The initialization procedure is actually a correction procedure by the code of one word, which is 
|so >. We will need rrr' ancilla qubits. First apply on each qubit in the first block a rotation around 
the X axis. After let us refer to the state -^(10™ > +11™ >) on m qubits as a "cat state". To 
generate such a "cat state" apply a rotation around the x axis of the first qubit and then a controlled 
not from this qubit to all the other m — 1 qubits. To compute the syndrome of a word in a quantum 
code which contains only |so generate k such "cat states" on mk ancilla qubits, and add km ancilla 
qubits which are all in |0 >. To compute the j'th bit of the syndrome, apply controlled not from 
the block we are initializing to each of the "cat states" bitwise, only on the coordinates which in the 
j'th raw of the parity check matrix of CP'^^p are 1. Now apply a controlled not from these cat states 
to the "blank" ancilla states, to imitate a measurement on them. Now compute from each cat state 
the syndrome bit, using only gates from the universal set. To perform the initialization procedure, 
compute the syndrome in the above way independently for each qubit, i.e. m times. ^From each j'th 
copy of the syndrome, compute whether the j'th bit is wrong or not. This is done as follows: the 
vector space can be divided to strange cosets of the subspace C^'^^p. Each coset can be written as 
(jperp _|_ g -vjfj^gj-g e is a vector. Each such e gives one possible syndrome. (Hc=s). Given the syndrome, 
we compute the table s— > e, and decide whether a qubit is wrong by asking whether it is in the 
support of e, meaning that the corresponding coordinate in e is 1. Finally apply controlled not from 
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the results to the initialized qubits. After the first rotations we have X]i=o~ I* >• The corrections 
will then take this state to an equal distribution over all the basic states in C'p«''p. The fact that this 
distribution is uniform is due to the linearity of the code. 

So the initialization procedure is actually defined by correcting an ancilla block to |so > and than 
using the block we are interested in initializing, and apply a controlled not from each bit to the bit 
of the |so >• This will not change |so > if the input string is all O's but will convert it to |5i > if the 
string is a string of I's, and the resulting state is the output of the initialization procedure. 

The spread of this procedure is 1: a fault in the cat states can only effect one qubit at the end. A 
fault in the first rotations and in the first controlled not gates can only effect one bit at the end. 

(2) Correction procedure: For the correction procedure we first create a state |so > on ancilla 
qubits. We than apply a correction procedure, exactly as the procedure in the initialization procedure, 
only that instead of computing from the j'th copy of a syndrome whether the j'th bit is wrong, we 
also compute whether the number of faults according to the syndrome is larger than d. The controlled 
not from the result to the j'th qubit is replaced by a Toffoli gate which also checks if the number of 
faults is smaller than d. We also add a gate which replaces the qubit with a qubit from the state |so > 
if the number of faults is indeed larger that d. After this, all the qubits are rotated in the x axis and 
than the whole sequence of gates is repeated, and than all the qubits are again rotated in the x axis. 

(3) Reading procedure: This procedure requires m(m + 1) ancilla qubits. First we apply con- 
trolled not from each of the qubits to one of the last m ancilla qubits. This simulates m basic 
measurements of these qubits We repeat this operation again to each one of the m blocks of m 
ancilla qubits, so we have m copies of the measured state. On each of these copy we apply an op- 
eration that computes the bit that is represented by this state, using only gates from the universal 
set. (This might require more ancilla qubits.) The resulting qubits are the m qubits which carry the 
results from these m computations. The spread of this procedure is 1. A fault in the first stage of 
copying the qubits m times can only effect one qubit in each of the copies, and if the number of faults 
is smaller than the critical number, the fault has no effect on the resulting qubits. A fault during the 
computation of one bit can only effect this bit. So the spread is 1, as long as the sum of damage in 
the block and number of faults in the first stage is smaller than half the minimal distance of the code. 

(4) The procedures of a controlled not gate: \Sa, Sb >i — > \Sa, S{a + b) >, The Fourier transform, or 
the rotation around the x axis by tt: \Sa >i — > J2bi^^)"'^\'^^ ^he not gate \Sa >i — > |S'(1 — a) >, 
and also a rotation around the z axis by tt/2: \Sa >i — > {i)'^\Sa >, is achieved on the encoded state 
by applying bitwise the gates on each of the qubits in the block. The procedure's spread is 1: a fault 
can only effect one qubit. 

(5) TofFoli gate: we define a Toffoli procedure as is described in ||T^, where all the measurements 
are replaced by controlled not gates. The only piece of this procedure which is not straight forward 
is creating the ancilla state \A >. The way we do that is create a cat state of encoded qubits: i.e. 
use m blocks of qubits that we first initialize to the state 15*0 >™, and rotate the first block, and then 
copy this block bitwise on all the other blocks, giving the state: -^(I'S'o > \So > ■■■\So > +\si > \Si > 
...\Si >). create three such ancilla states. Also create \ A > +\B > a.s in Now apply m times the 

transformation: \Sa > \b > \c> \d > > {-l)'^^'"'+'^^\Sa > |6 > |c > |c? > on a block in the first 

encoded cat state and three bits in the three blocks of |A >, then do the same thing with the second 
cat state and then the third. To measure the cat state, rotate each of the blocks in the cat states in 
the X direction. Now compute from each block the bit it represents, and than independently m times 
the parity of these bits in each cat state. For each qubit in the third block of \A >, compare three 
parity bits from the three cat states by a majority vote and apply a controlled not from the result to 
the qubit in |A >. If only one fault occurred in this procedure, than in each block of |yl > there is at 
most one deviated qubit. This means that the procedure is fault tolerant. 
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12 Appendix E 



In this section we describe the gate procedures for the polynomial quantum codes over Fp. The 
initialization, reading and correction procedure are like for general linear codes. 

(1) The procedure of a general not gate, \Sa >i — > \S{a + c) >. A general controlled not gate: 
15*0 > 15*6 >i — > \Sa > \S{a + b) > and the following operations: For a fixed constant 7^ c G F: 
15*0 >i — > \S{ac) > are done by applying the same gates pitwise on the qupits. 

(2) The procedure of a general ToffoH gate \Sa > \Sb > \Sc >i — > \Sa > \Sb > \S{c + ab) > is 
applied as follows: First we apply pitwise the general Toffoli gate on the m coordinates. On the third 
block we obtain the sum: 

^ |A(ai)B(ai) +C(ai),...,yl(a„OB(a,„) + C(a„0 > . 

A(x),B{x),C(x)eVl,A(Q)=a,B(0)=b,C('0)=c 

The polynomial D{x) = A{x)B{x) + C{x) satisfies I?(0) — ab ~\- c, and it's degree deg{D) < 2d. To 
reduce the degree we use a quantum analog of the techniques in 1^, where we keep the procedure 
fault tolerant, we can still correct d errors in D since m = 4d + 1. We proceed as follows: we apply 
the initialization procedure to each coordinate in the third block, which will give the state 

\S{di), ...S{dm) > , with dj — D{aj). 

D(x),D(x)=A(x)B{x)+C(x) 

We then first run the error correcting procedure of the code with degree 2(i, and after this compute 
the linear combination Si^iCidi) = Sd, where the q are the interpolation coefficients such that 
V / G F[x], degif) < m - 1, /(O) = J:T=i c^fi^^)■ 

(3) The procedure \Sa >i — > w^°'\Sa > \/c ^ F, (This generalizes a rotation around the z axis by 
the angle tt.) is done by on the I'th qupit the gate \a >i — > w'^'°'\a >. The proof that this achieves the 
desired operation is : 

\s,>=^— J2 l/(«i),-,/KO>^ E n-iz.='^("')|/(«i),-,/(«m)>= 

^' ' fev,f{o)=a feVl.JiO)=a 

= E w"|/(ai),...,/(a,„) > . 

/evj(o)=a 

(4) The Fourier transform: \Sa >i — > -^J2bGF^''''\Sb > ■ (This can be done with any by 
replacing in the following w hy w"^ . This operation generalizes the rotation around the x axis by the 
angle tt.) 

To perform this procedure we first note that there are fixed non zero ei, such that for any 
polynomial f{x) over Fp with deg{f) < m — 1, f2d = X^e Ci/(ai). This is true since interpolation via 

ai, ...am is a linear functional. Denote wi — w'^'"'' ,1 = 1, ...,m. Let us operate on each coordinate, 
that is qupit, by the Fourier transform 



beF„ 



We claim that this indeed gives the desired operation. This is true since 

Vr ^1 /gv,/(0)=a bl,b2,..bmi£F feV,f{0)=a 

Let b{x) be the unique interpolation polynomial b{ai) = hi, with degree deg(b) < m — 1, for some 
bi, ■■■bm € Fp. We distinguish two cases: 
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• CASE 1: Deg{b) < d. In this case the polynomial h{x) = x'^'^b{x)f{x) for f{x) G VI is of degree 

< 4d = m — 1 and so 



J^eiaf'^fiaiJbi = f{0)b{0) = coeff of x^'^ in h{x). 



1=1 

In the above sum, we will have: 



^ 61,62,. .6meF,6(x)eyi /ey,/(0)=a 6eFp 



• CASE 2: Deg{b) > d. We claim that the sum vanishes for the b's in this case. Let h{x) be the 
interpolating polynomial through the values af'^f{ai)bi. Then h{x) = x'^'^ f{x)b{x){modG{x)). 
recall the definition og G(x). The power of w in the sum is the coefficient of x'^ in this polynomial. 
It is enough to show that this is not always the same value when summing over / e V\ with 
/(O) — a, since then the sum vanishes. Let r = deg{h) > d. Picking f{x) ~ a + cx'^'^~^~^^, 
deg{f) < d, and deg x'^''' f {x)b{x) = M+1 = m. Therefore h{x) = x^'^ f {x)b{x) — cBrG{x) where 
Br is the leading coefficient in b{x), i.e b{x) = BrX^ + ... + So- ^ 0. Looking at the coefficient 
of .E^^ of h{x) we have aB^ — cBrg-id where g2d 7^ is the coefficient of x'^'^ in G{x). This can 
obtain any value we want by selecting an appropriate c € Fp. 
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